AI Designed Synthetic Viruses Are Here and the Safety Net Has a Hole
A team from Stanford University and the Arc Institute published a paper recently in Science that changed what AI can do in biology: they used a genome language model to write complete viral genomes from scratch, then built those viruses in a laboratory. Sixteen of them worked. None of them had ever existed in nature.
This is not science fiction, and it is not a bioterrorism alert. The short answer to what happened: researchers used an AI model called Evo 2 trained on DNA the way ChatGPT is trained on text to generate new bacteriophage genomes. Bacteriophages are viruses that attack bacteria, not humans. Of roughly 302 synthesized candidates, 16 proved fully functional, killing drug-resistant E. coli strains in lab dishes. That is the factual core. Everything else the promise, the risk, the governance gap flows from understanding exactly how they did it.
What Is a Bacteriophage, and Why Should You Care?
A bacteriophage is a virus that hunts bacteria. It cannot infect human cells. Think of it as a parasite with a very specific host one that happens to be the same bacteria that are increasingly killing us in hospitals. Bacteriophages were used medically before antibiotics were discovered, then largely set aside once penicillin arrived, and are now being reconsidered urgently as the antibiotic era shows its limits.
The stakes are not abstract. Antibiotic-resistant infections are projected to kill 39 million people between 2025 and 2050 roughly three deaths every minute according to the Global Research on Antimicrobial Resistance Project’s landmark Lancet analysis. Bacteriophage therapy for antibiotic resistance has long suffered from one practical problem: you need a phage that matches your specific bacterial strain, at the specific moment a patient needs it, and the natural library of known phages is both limited and slow to screen. Generative AI viral genome design changes that equation in a way traditional drug development cannot.
How Does a Genome Language Model Like Evo 2 Actually Design a Virus?
Here is the mechanically honest explanation that most coverage skips.
Evo 2 works on the same core principle as a text language model: it predicts the next token given everything before it. The difference is that instead of words, its tokens are individual DNA nucleotides A, C, G, and T. The model was trained on over 9.3 trillion nucleotides drawn from more than 128,000 whole genomes spanning bacteria, archaea, eukaryotes, and phages. That training corpus taught it the statistical grammar of life which DNA sequences co-occur, which combinations tend to produce functional proteins, which arrangements are evolutionarily stable across species.
A text LLM learns that “the dog ran across the” is likely followed by “street” or “yard,” never “photosynthesis.” Evo 2 learns the biological equivalent: that certain gene arrangements in viral genomes co-occur with certain structural proteins in ways that produce a replication-capable organism. The model did not start from nothing. For this experiment, the team fine-tuned Evo 2 on approximately 14,000 genomes from the Microviridae family the same family as ΦX174, a bacteriophage that holds a particular place in science history as the first DNA-based genome fully sequenced by Fred Sanger in 1977. Given a snippet of ΦX174 DNA as a prompt, Evo 2 generated candidate full genomes, letter by letter, predicting the most biologically plausible continuation.
One critical architectural distinction separates Evo 2 from earlier biological AI: context length. Its StripedHyena 2 architecture can process sequences up to 1 million base pairs long at single-nucleotide resolution. Earlier models missed long-range dependencies a regulatory element hundreds of thousands of bases away that controls whether a gene activates. Evo 2 can hold the entire relevant context in view simultaneously, which is essential for designing something as interdependent as a full genome.
The team fed those candidate genomes through bioinformatics filters checking for valid gene arrangement, correct spike protein conservation, and evolutionary diversity and wound up with 302 candidates worth synthesizing. Lab teams then ordered those sequences from a DNA synthesis company, circularized the resulting DNA, and introduced it into E. coli cultures. If the culture went clear, the bacteria were dead. Sixteen did.
16 Out of 700,000: Why That Number Is Both Impressive and Honest
Most headlines led with the 16 functional viruses. Few mentioned the full picture. Evo 2 generated an enormous pool of candidate genomes before filtering. The 302 synthesized candidates came from that vast pool, and just 16 proved viable. That is a roughly 5% yield among filtered, computationally selected candidates a success rate that shows AI genome design working at a level no previous method matched, while also demonstrating that the model cannot yet reliably produce viable genomes on demand.
Some of those 16 outperformed natural ΦX174. A cocktail of the generated phages overcame ΦX174-resistant E. coli strains that had already developed immunity to the natural virus. Cryo-electron microscopy confirmed that one of the AI-designed phages used an evolutionarily distant DNA-packaging protein in its capsid a structural solution no natural evolutionary pressure had produced. That is the insight buried in the technical data that the breathless headlines mostly missed: the AI did not mimic nature, it found solutions nature had not explored.
What the Johns Hopkins Warning Actually Says and What It Doesn’t
The same issue of Science that published the Stanford paper also published a companion editorial by Thomas Inglesby and Moritz Hanke of the Johns Hopkins Center for Health Security. Their conclusion was precise: “The ability to compose viral genomes using generative AI now exists; the governance to safely steer it does not.”
Their sharpest concern is not about Evo 2 specifically. It is about the DNA synthesis chokepoint. When a researcher orders a custom DNA sequence, synthesis companies currently screen those orders but voluntarily, not by law, and only by comparing the ordered sequence against a database of known dangerous sequences. An AI-designed synthetic biology AI-generated pathogen, by definition, may share no significant similarity with any sequence in that database. It has never existed. The screening system was built to catch known threats, not novel ones. As Inglesby and Hanke noted, because AI-generated genomes can be very different from any previously characterized nucleic acid sequence, new detection tools tuned to catch novel AI-written designs need to be developed urgently and none exist in deployed form today.
This is the specific biosecurity oversight gap that almost no top-ranking news page explained clearly. The problem is not that Evo 2 could directly produce a bioweapon. The problem is that the governance infrastructure protecting DNA synthesis the one physical step between a digital genome sequence and an actual organism was not designed for a world where the sequences arriving in inboxes were never carried by any living cell.
Can AI Designed Synthetic Viruses Actually Hurt People?
This is where the expert disagreement matters, and most coverage flattened it in one direction.
The alarmist reading says: the same generative AI viral genome design capability that produced bacteriophages could, in theory, be applied to human-infecting viruses. Inglesby and Hanke did not dismiss that concern. Hanke separately noted that you could simply prompt a genomic language model to generate a modified influenza genome. That is a real risk worth taking seriously.
The skeptical counterpoint, largely absent from top results, comes from people like Tom Ellis, a professor of synthetic genome engineering at Imperial College London, who argued that this specific AI capability remains constrained. Gain-of-function modifications to known existing pathogens which is already possible with older techniques presents a far more immediate danger than building a novel functional pathogen from scratch using generative AI. The Stanford team’s own numbers support some caution about overstating the near-term threat: 5% yield on bacteriophages, which are among the simplest genomes in biology. Scaling that capability to something like influenza, which has a far more complex genome and requires evading a sophisticated human immune system, is not a one-step extension.
The Arc Institute built in two meaningful safeguards from the start. The team excluded all eukaryotic virus sequences from Evo 2’s training data, and verified that this exclusion produced effectively random outputs when the model was tested on human viral proteins meaning the model is currently a poor tool for designing human-targeting viruses. The team also consulted biosafety professionals throughout the project rather than after publication. Inglesby and Hanke acknowledged this directly, calling the Stanford team’s biosecurity engagement more deliberate than most developers of powerful biological AI models.
That said, the Arc Institute’s own researchers acknowledged that further work on model alignment will be needed as future versions of biological foundation models become more capable. Openness of model weights also introduces a real risk: a determined actor who wanted to fine-tune Evo 2 on the excluded data could potentially recover some of the dangerous capabilities the training exclusion was meant to prevent.
Where the AI Biosecurity Risks in Biology Go From Here
The policy conversation is moving, but slowly. Senators Tom Cotton and Amy Klobuchar introduced the Biosecurity Modernization and Innovation Act in January 2026, which would require sequence and customer screening for all gene synthesis providers. The bill had not passed as of this writing, and critics have noted that even if it did, it relies primarily on sequence-similarity screening the same architecture that is already blind to novel AI-generated sequences. The real legislative need is for function-based screening: evaluating what a sequence can do, not just what it resembles.
The larger issue is pace. Generative AI biology risks and regulation 2026 debates are happening in real time, while the technology advances in months rather than years. The AI bioweapon risk gain of function comparison that experts like Ellis make is useful context gain-of-function research is heavily restricted and monitored, because it poses well-understood dangers. AI designed synthetic viruses sit in a different category: novel, fast-moving, and currently under no equivalent regulatory framework.
The Genuine Promise: Phage Therapy as a Real Alternative to Antibiotics
None of the biosecurity conversation should obscure what the Stanford team actually built. This is a proof of concept for a phage therapy alternative to antibiotics approach that could matter enormously in a world where drug-resistant E. coli, MRSA, and Pseudomonas aeruginosa are killing people whose infections have exhausted every available antibiotic. Brian Hie’s core argument is that cocktails of genetically diverse AI-designed phages would be far harder for bacteria to develop resistance to than any single medication because resistance to one phage in a cocktail does not neutralize the others.
Clinics already use bacteriophage therapy for drug-resistant bacterial infections. The bottleneck is matching the right phage to the right strain quickly enough to help a dying patient. Generative genomics could, in principle, allow clinicians to generate a custom phage on demand designed specifically for the strain causing infection in that specific patient. That is a different medical future from the one we currently live in. It requires this science to mature, this governance to catch up, and both communities to stay in the same room.
Conclusion: Watch the DNA Synthesis Window, Not Just the Headlines
The real story here is not that AI made viruses. It is that for the first time, AI designed synthetic viruses that had never existed anywhere in nature, and some of them worked better than their natural counterparts. The medical opportunity is substantial. The governance gap is real and specific: the companies that print DNA to order are the last physical checkpoint between an AI-generated genome and a living organism, and they are neither legally required to screen orders nor equipped with tools that can detect sequences with no natural precedent.
If you follow this space, track two things: the progress of legislation around mandatory DNA synthesis screening, and whether the scientific community develops function-based genome evaluation tools that look at what a sequence can do rather than what it matches. That is where the actual safety of this technology will be won or lost not in the lab where Evo 2 runs, but in the regulatory framework around the synthesis companies that print its output.
The science worked. The governance has not caught up yet. That gap is the story.
Frequently Asked Questions
Can the AI-designed viruses infect humans?
No. The 16 viruses created in this study are bacteriophages, meaning they infect bacteria only, not human cells. The researchers deliberately excluded all human-infecting virus sequences from Evo 2’s training data and verified this produced effectively random, non-functional outputs when tested against human viral proteins.
What is a bacteriophage and how is it different from viruses that make people sick?
A bacteriophage is a virus that specifically targets and kills bacteria. Unlike influenza or COVID-19, which hijack human cells, bacteriophages only infect bacterial cells. They pose no direct threat to human health and are already used medically in some countries to treat bacterial infections that no longer respond to antibiotics.
How does a genome language model like Evo 2 actually design a virus?
Evo 2 predicts the next DNA nucleotide in a sequence given everything that preceded it exactly as a text model predicts the next word. Trained on 9.3 trillion nucleotides from over 128,000 genomes, it learned the statistical grammar of functional DNA. Fine-tuned on 14,000 phage genomes, it generated candidate viral sequences that were then physically synthesized and tested in the laboratory.
Why did scientists at Johns Hopkins warn against the very research Stanford published?
Thomas Inglesby and Moritz Hanke of the Johns Hopkins Center for Health Security praised the Stanford team’s biosafety practices while warning that the underlying capability AI generating complete viral genomes now outpaces the governance systems designed to prevent misuse. The core issue is that DNA synthesis screening tools cannot detect sequences that have never existed in nature, which is precisely what AI-generated genomes may be.
Could this technology be used to create biological weapons?
Not easily, and not yet but the concern is real. Current AI genome design has roughly a 5% success rate on simple bacteriophage genomes, and weaponizing a human-targeting pathogen is orders of magnitude more complex. Experts like Tom Ellis of Imperial College London argue that traditional gain-of-function modifications to known pathogens remain a far more immediate threat. However, the same generative AI capability could in theory be applied to dangerous pathogens, which is why biosecurity experts are calling for regulatory action now.
What safeguards did the Stanford team build into the experiment?
The team took three primary precautions: they excluded all eukaryotic virus sequences from Evo 2’s training data; they used only non-pathogenic bacterial hosts in laboratory testing; and they consulted biosafety professionals throughout the project. They also verified computationally that the training exclusions weakened the model’s ability to generate functional human-viral sequences.
Why can’t current DNA screening systems detect these AI-generated virus sequences?
Existing screening systems work by comparing an ordered DNA sequence against databases of known dangerous sequences. An AI-generated genome that has never existed in any living organism will match nothing in those databases. The screening infrastructure was designed for a world where humans only modified existing sequences not one where AI can compose entirely novel ones from scratch.